Researcher reports first Firefox 3.0 bug

Researcher sells critical vulnerability in browser to TippingPoint's bug bounty program

Only hours after Mozilla launched the final of Firefox 3.0, a researcher sold a critical vulnerability in the browser to TippingPoint's bug bounty program, the security company acknowledged Wedesday.

The bug has been reported to Mozilla, TippingPoint announced in a post to a company blog. "While Mozilla is working on a fix, we won't be divulging anything else until a patch is available," said TippingPoint, citing policy. "Once the issue is patched, we'll be publishing an advisory."

The Austin, Tex.-based security vendor operates the Zero Day Initiative (ZDI), one of two prominent vulnerability purchasing programs, and regularly buys bugs from independent researchers, then reports the flaws to the appropriate vendor. It's perhaps best known for sponsoring an annual hacking contest, in which researchers try to break into stock Windows, Mac OS X or Linux laptops, at the annual CanSecWest security conference.

TippingPoint released little information about the Firefox bug other than to confirm that it affects the new Firefox 3.0 as well as older 2.0 versions. TippingPoint classified the vulnerability as "critical" and said it could be used to execute remote code. There is one caveat, however, said TippingPoint. "Not unlike most browser-based vulnerabilities that we see these days, user interaction is required, such as clicking on a link in e-mail or visiting a malicious Web page."

The company didn't hint whether the vulnerability was present in all editions of Firefox 3.0, or was specific to one operating system. However, it hinted that a patch might come quickly. "Working with Mozilla on past security issues, we've found them to have a good track record and expect a reasonable turnaround on this issue as well," said TippingPoint.

Mozilla regularly touts its patch speed when it defends its security record. Last January, for instance, Window Snyder, the open-source vendor's chief security executive, rebutted a news report that claimed Firefox was less secure than Microsoft's Internet Explorer by noting that Mozilla patches faster than Microsoft. "At Mozilla we work as hard as we can to ship fixes as soon as possible to minimize the exposure to our users," she said then in a post to the company's security blog.

Mozilla was not available late Wednesday for comment or to answer questions.

Firefox 3.0, released Tuesday, was downloaded more than 8.3 million times in its first 24 hours of availability.

(Read Firefox 3.0 review here).

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?